sakula | 9f4185b5dadf88755af886100db5e00c1a5f3b7f483ecbfb5b59ae120d6d3cc7

General

Target

18a251937cfacd90d906fb47c238185c_JC.exe
Size

100KB
MD5

18a251937cfacd90d906fb47c238185c
SHA1

62fd02ff9d0b71edc10fc0cc32f5a6727a6d482a
SHA256

9f4185b5dadf88755af886100db5e00c1a5f3b7f483ecbfb5b59ae120d6d3cc7
SHA512

6892ba52971889b38cafc96221aa19aa532958a916f4cc95ddd794c36987940c30fd1bdcb9bce7b8d1b20c5b2528971983574dd4eafbc395f144689bbac79a2e
SSDEEP

1536:Loaj1hJL1S9t0MIeboal8bCKxo7h0RPaaml0Nz30rtrsxu:c0hpgz6xGhZamyF30Boxu

Score

10^/10

sakula persistence rat trojan

Malware Config

Signatures

Sakula
Sakula is a remote access trojan with various capabilities.
trojan rat sakula

Sakula payload 9 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1824-0-0x0000000000400000-0x000000000041B000-memory.dmp	family_sakula
\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe	family_sakula
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe	family_sakula
\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe	family_sakula
behavioral1/memory/2304-10-0x0000000000400000-0x000000000041B000-memory.dmp	family_sakula
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe	family_sakula
behavioral1/memory/1824-11-0x0000000000400000-0x000000000041B000-memory.dmp	family_sakula
behavioral1/memory/2304-13-0x0000000000400000-0x000000000041B000-memory.dmp	family_sakula
behavioral1/memory/1824-15-0x0000000000400000-0x000000000041B000-memory.dmp	family_sakula

Deletes itself 1 IoCs

Processes:

cmd.exe

pid process

2648 cmd.exe
Executes dropped EXE 1 IoCs

Processes:

MediaCenter.exe

pid process

2304 MediaCenter.exe
Loads dropped DLL 2 IoCs

Processes:

18a251937cfacd90d906fb47c238185c_JC.exe

pid process

1824 18a251937cfacd90d906fb47c238185c_JC.exe
1824 18a251937cfacd90d906fb47c238185c_JC.exe

pid	process
2648	cmd.exe

pid	process
2304	MediaCenter.exe

pid	process
1824	18a251937cfacd90d906fb47c238185c_JC.exe
1824	18a251937cfacd90d906fb47c238185c_JC.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

18a251937cfacd90d906fb47c238185c_JC.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\MicroMedia = "C:\\Users\\Admin\\AppData\\Local\\Temp\\MicroMedia\\MediaCenter.exe"	18a251937cfacd90d906fb47c238185c_JC.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery
T1018

Processes:

PING.EXE

pid process

2740 PING.EXE
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

18a251937cfacd90d906fb47c238185c_JC.exe

description pid process

Token: SeIncBasePriorityPrivilege 1824 18a251937cfacd90d906fb47c238185c_JC.exe

pid	process
2740	PING.EXE

description	pid	process
Token: SeIncBasePriorityPrivilege	1824	18a251937cfacd90d906fb47c238185c_JC.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

18a251937cfacd90d906fb47c238185c_JC.execmd.exe

description	pid	process	target process
PID 1824 wrote to memory of 2304	1824	18a251937cfacd90d906fb47c238185c_JC.exe	MediaCenter.exe
PID 1824 wrote to memory of 2304	1824	18a251937cfacd90d906fb47c238185c_JC.exe	MediaCenter.exe
PID 1824 wrote to memory of 2304	1824	18a251937cfacd90d906fb47c238185c_JC.exe	MediaCenter.exe
PID 1824 wrote to memory of 2304	1824	18a251937cfacd90d906fb47c238185c_JC.exe	MediaCenter.exe
PID 1824 wrote to memory of 2648	1824	18a251937cfacd90d906fb47c238185c_JC.exe	cmd.exe
PID 1824 wrote to memory of 2648	1824	18a251937cfacd90d906fb47c238185c_JC.exe	cmd.exe
PID 1824 wrote to memory of 2648	1824	18a251937cfacd90d906fb47c238185c_JC.exe	cmd.exe
PID 1824 wrote to memory of 2648	1824	18a251937cfacd90d906fb47c238185c_JC.exe	cmd.exe
PID 2648 wrote to memory of 2740	2648	cmd.exe	PING.EXE
PID 2648 wrote to memory of 2740	2648	cmd.exe	PING.EXE
PID 2648 wrote to memory of 2740	2648	cmd.exe	PING.EXE
PID 2648 wrote to memory of 2740	2648	cmd.exe	PING.EXE

C:\Users\Admin\AppData\Local\Temp\18a251937cfacd90d906fb47c238185c_JC.exe
"C:\Users\Admin\AppData\Local\Temp\18a251937cfacd90d906fb47c238185c_JC.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1824

C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
2⤵
- Executes dropped EXE
PID:2304

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c ping 127.0.0.1 & del /q "C:\Users\Admin\AppData\Local\Temp\18a251937cfacd90d906fb47c238185c_JC.exe"
2⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
PID:2648

C:\Windows\SysWOW64\PING.EXE
ping 127.0.0.1
3⤵
- Runs ping.exe
PID:2740

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Remote System Discovery

1

T1018

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
Filesize
100KB

MD5
1d01c548700d91dd37a1a148ebea435e

SHA1
edcc5beed1c1cee27e8872bd342d38aa989f2fd0

SHA256
0c8f76a3e13e267d0ce5eefd7cf73f95ad820a6441fb7d48b5a02b9cfdacad56

SHA512
59ed540a302cd75989b79940e8f07252fadabac0b068a2b1ee2210c3b9cb131400cdacd68709092525d5a3b31c0a2689e3c8773ac8d32f2199b7f960e863d2c6

Download Submit
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
Filesize
100KB

MD5
1d01c548700d91dd37a1a148ebea435e

SHA1
edcc5beed1c1cee27e8872bd342d38aa989f2fd0

SHA256
0c8f76a3e13e267d0ce5eefd7cf73f95ad820a6441fb7d48b5a02b9cfdacad56

SHA512
59ed540a302cd75989b79940e8f07252fadabac0b068a2b1ee2210c3b9cb131400cdacd68709092525d5a3b31c0a2689e3c8773ac8d32f2199b7f960e863d2c6

Download Submit
\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
Filesize
100KB

MD5
1d01c548700d91dd37a1a148ebea435e

SHA1
edcc5beed1c1cee27e8872bd342d38aa989f2fd0

SHA256
0c8f76a3e13e267d0ce5eefd7cf73f95ad820a6441fb7d48b5a02b9cfdacad56

SHA512
59ed540a302cd75989b79940e8f07252fadabac0b068a2b1ee2210c3b9cb131400cdacd68709092525d5a3b31c0a2689e3c8773ac8d32f2199b7f960e863d2c6

Download Submit
\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
Filesize
100KB

MD5
1d01c548700d91dd37a1a148ebea435e

SHA1
edcc5beed1c1cee27e8872bd342d38aa989f2fd0

SHA256
0c8f76a3e13e267d0ce5eefd7cf73f95ad820a6441fb7d48b5a02b9cfdacad56

SHA512
59ed540a302cd75989b79940e8f07252fadabac0b068a2b1ee2210c3b9cb131400cdacd68709092525d5a3b31c0a2689e3c8773ac8d32f2199b7f960e863d2c6

Download Submit
memory/1824-0-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/1824-8-0x00000000002B0000-0x00000000002CB000-memory.dmp

Filesize
108KB

Download
memory/1824-11-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/1824-12-0x00000000002B0000-0x00000000002CB000-memory.dmp

Filesize
108KB

Download
memory/1824-14-0x00000000002B0000-0x00000000002CB000-memory.dmp

Filesize
108KB

Download
memory/1824-15-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/2304-10-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/2304-13-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads